Illinois top court endorses five-year window for biometric privacy claims
(Reuters) - The Illinois Supreme Court on Thursday said workers and consumers have five years to sue for violations of the state's unique biometric privacy law, rejecting a much narrower window pushed by business groups.
The court in a 5-0 ruling said that because the Illinois Biometric Information Privacy Act (BIPA) does not specify a statute of limitations for lawsuits, a five-year "catchall" period in the state code of civil procedure applies.
Logistics company Black Horse Carriers Inc, which is facing a proposed class action alleging BIPA violations, had argued that a one-year limitations period in the state code for lawsuits involving the publication of private information should apply to BIPA claims.
But the high court said that a five-year statute of limitations would better effectuate the law's stated goal of addressing the risks to the public surrounding the disclosure of highly sensitive biometric information.
Lawyers for Black Horse did not immediately respond to a request for comment on Monday. Nor did lawyers for two truck drivers who had sued the company.
The Illinois Chamber of Commerce had filed an amicus brief last March warning that a five-year window would increase companies' exposure to "potentially catastrophic damages" in BIPA cases.
Nearly 2,000 lawsuits alleging violations of BIPA have been filed since 2017, yielding a series of massive settlements and judgments.
Meta Platforms Inc's Facebook in 2020 agreed to pay $650 million to settle a BIPA class action involving its use of facial recognition software. The company denied wrongdoing.
In October, following the first-ever trial in a BIPA case, a jury ordered BNSF Railway Co to pay $228 million for collecting truck drivers' fingerprints without their consent. The railroad has moved for a new trial, saying the award was unreasonable.
The BIPA, adopted in 2008, requires companies that collect biometric information such as fingerprints and retinal scans to obtain permission beforehand and to notify workers and consumers of how that information will be used.
It is the only law in the U.S. that grants a private right of action to sue over the mishandling of biometric information.
The 2019 proposed class action against Black Horse claims the company failed to obtain written consent before obtaining drivers' fingerprints and sharing them with a third party contractor.
A mid-level appeals court in a novel 2021 ruling said the limitations period is one year for BIPA claims alleging unlawful disclosure and five years for claims involving notice, consent or retention. Black Horse appealed.
On Thursday, Justice P. Scott Neville wrote for the Illinois Supreme Court that applying different limitations periods to distinct BIPA claims "would create an unclear, inconvenient, inconsistent, and potentially unworkable regime."
The court remanded the case to a state judge for further proceedings.
The case is Tims v. Black Horse Carriers Inc, Illinois Supreme Court, No. 127801.
For the plaintiffs: Ryan Stephan and James Zouras of Stephan Zouras
For Black Horse: David Schultz of Hinshaw & Culbertson
Read more:
Illinois appeals court says window to file BIPA claims varies
Facebook raises settlement to $650 million in facial recognition lawsuit
Facebook pivots from facial recognition system following biometric privacy suit
BNSF must pay truck drivers $228 mln for privacy violation
Our Standards: The Thomson Reuters Trust Principles.
